Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

I'm developing a functionality to let only customers and doctors have access to exam results. But i'm not so sure about the strenght of my code in securing view only to those authorised.

I've gotten so far as to create the 'exam' post type to handle the information and added the metabox to save doctor and patient info in every exam (doctor and patient are also custom roles for users, with capabilities similar to subscribers).

then i've created this function to check if the user trying to view content is entitled to it:

/*
 * Checks if user is logged in and has access to that specific exam
 */
function rm_userauth_check() {
    global $current_user;
      get_currentuserinfo();
      $doctor = get_post_custom_values('doctor');
      $patient = get_post_custom_values('patient');
      $loggeduser = $current_user->user_login;
      $nicename = $current_user->display_name;
      $mainrole = $current_user->roles;

  if ($current_user->data !== null) {

      if ($mainrole[0] == 'doctor' && $loggeduser == $doctor[0]) {
          return true; // this user is a doctor and is assigned to this exam
      } elseif ($mainrole[0] == 'patient' && $loggeduser == $patient[0]) {
          return true; // this user is a patient and is assigned to this exam
      } else {
          return false; // this user is not assigned to this exam
      }
  } else {
      return false; // user is not logged in
  }

and now i'm calling it on my single-exam.php file as

        <?php if (function_exists('rm_userauth_check')) : ?>

        <?php if (rm_userauth_check()) : ?>

        <?php if ( have_posts() ) while ( have_posts() ) : the_post(); ?>

            <?php get_template_part( 'content', 'single' ); ?>

        <?php endwhile; // end of the loop. ?>
           <?php else : ?>
                       <?php wp_redirect( home_url() ); exit; ?>
           <?php endif; ?>
    <?php endif; ?>

How does it look to you? Am i going the right way here or should i try another method?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

The easiest way is to use if ( current_user_can( 'capability' ) ) // do stuff. You'll find more about capabilities in the codex. You can also inspect the data some user has attached with normal var_dump() and else. I also got a pretty old plugin for that. But I'm not sure if it still works with the current WP version. If it does, you'll be presented with close to all user data and some hints & snippets on a new admin page.

share|improve this answer
1  
This didn't do it for me just out of the box, but pointed to the right direction. I ended up creating new capabilites, specific to the post type, and restricting access to is with current_user_can. Thanks a bunch! –  moraleida Aug 24 '11 at 22:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.